text:
- Amazon Business : For business-only pricing, quantity discounts and FREE Shipping. Register a free business account
Learn more
The Emotionally Destructive Marriage: How to Find Your Voice and Reclaim Your Hope Paperback – September 17, 2013
|New from
|Used from
Audible Audiobook, Unabridged
"Please retry"
|Free with your Audible trial
Digital, Unabridged
"Please retry"
Explore your book, then jump right back to where you left off with Page Flip.
View high quality images that let you zoom in to take a closer look.
Enjoy features only possible in digital – start reading right away, carry your library with you, adjust the font, create shareable notes and highlights, and more.
Discover additional details about the events, people, and places in your book, with Wikipedia integration.
Ask Alexa to read your book with Audible integration or text-to-speech.
Enter your mobile number or email address below and we'll send you a link to download the free Kindle App. Then you can start reading Kindle books on your smartphone, tablet, or computer - no Kindle device required.
To get the free app, enter your mobile phone number.
Frequently bought together
Special offers and product promotions
Editorial Reviews
"This book is a lifeline for women who long to live a Christ-honoring life but are caught in the downward spiral of a destructive relationship. Leslie draws from a deep well of biblical insight, practical experience, and courageous advocacy to give individuals and the church the tools necessary to set captives free—one woman at a time."
—Joe Henseler, senior pastor of Faith Evangelical Free Church, Allentown, Pennsylvania
"As a radio host, I regularly hear from women who feel trapped in destructive marriages. Because they hear God hates divorce, they don't know what they can do. Leslie shows them exactly what they can do in this book. It's packed with solid, practical, and biblical steps to get sane, get safe, and get strong."
—Anita Lustrea, author, speaker, and host of Moody Radio's Midday Connection
"Though marriage is God's idea, many marriages are not being lived out according to God's plan. Leslie skillfully takes the reader through specific check points, uncovering relationships that are destructive while giving valuable tools for genuine healing. This book will point many couples in the direction of change and discovery of God's ultimate plan of mutual respect and love."
—Ray and Debbie Alsdorf, authors of Beyond the Brady Bunch
"The Emotionally Destructive Marriage blows the lid off the silence surrounding this serious epidemic in the church. It's packed with the kind of solid practical wisdom and bracing straight talk women need to face reality and engage safely the crisis in their marriage. Every Christian leader should read this eyeopening corrective to damaging advice often coming from the church to women in abusive marriages. Women who are at the end of their rope will find this book to be an invaluable lifeline."
—Carolyn Custis James, author of The Gospel of Ruth and Half the Church
"This book provides answers and action for women who are caught in the vicious cycle of emotional abuse. Kudos to Leslie Vernick for addressing and exposing this prevalent problem head on and offering her wise counsel to hurting women."
—Suellen Roberts, founder and president of Christian Women in Media
"The Emotionally Destructive Marriage is the perfect tool for pastors, counselors, and marriage leaders to help women caught in destructive marriages. Written with a softness that only Leslie Vernick could deliver but with a tenacity to motivate and help women recognize their plight, this book provides the practical insights they need to step into the emotional and relational freedom they deserve."
—Joshua Straub, PhD, coauthor of God Attachment
"Women in an emotionally abusive marriage do not need another book on how to have a good marriage; those books rub salt in raw wounds. No, they desperately need this book so that they can diagnosis just how bad their marriage is and then, with Leslie's clear expertise, develop a plan that will either begin to turn their marriage around, strengthen them to stay and survive, or give them a wise route of escape. I was riveted from the first chapter and thanked God repeatedly for this clear manual for those who are in such need of a lifeline."
—Dee Brestin, author of Idol Lies and The Friendships of Women
"The Emotionally Destructive Marriage extends a lifeline of well-tested, biblically sound, practical, real help to women who are often at the end of their rope, end of their ability to cope, and end of their hope. Leslie's common-sense wisdom and tender encouragement might help save your marriage, your family, and your future—and it will for sure save your sanity, your life, and your heart. Every leader, and every woman, needs copies to hand out."
—Pam Farrel, author of The 10 Best Decisions a Woman Can Make and Men Are Like Waffles; Women Are Like Spaghetti
"This book is a significant contribution to Christian literature on the subject of abuse in marriage. Into church cultures so often clouded by a fog of confusion and unbiblical tradition, Leslie's words shine a welcome light. She understands the mentality and nature of abuse that drives these emotionally destructive marriages. I intend to put her book to use in our church in both women's and men's groups, and I would encourage Bible colleges and seminaries to do the same."
—Jeff Crippen, pastor and author of A Cry for Justice: How the Evil of Domestic Abuse Hides in Your Church
"Leslie's book tackles a hidden epidemic behind the closed doors of many Christian homes. Leslie provides help—winsome yet tough, practical yet immensely biblical help—for those in destructive marriages. Counselors, pastors, and Christian ministry leaders are given a clear compass to know how to take a marriage from broken to whole, if both individuals are willing to work."
—Tim Clinton, PhD, president of the American Association of Christian Counselors and executive director of the Center for Counseling and Family Studies at Liberty University
"Heart-to-heart reality checkup. Destructive myths and assumptions exposed. Marriages advanced. Women valued. Hopeful steps for real change. That's how Leslie Vernick writes to women who are under attack in marriage. She provides fresh God-honoring solutions as she speaks life-changing truth for women. Her honesty and mandates for frustrated or failed marriage relationships are invigorating, incredible, practical, and based on the Bible."
—Roger Ball, senior pastor of First Baptist of Tempe
"Finally, a voice being put to the very real problem of emotional abuse within a marriage and the invisible wounds it inflicts on the spirit, heart, and mind. Leslie Vernick brings light to the breakdown that happens in a relationship marked by toxic behavior. Her years of wisdom and expertise in this area, along with her biblical insight, are to be applauded. Thank you, Leslie, for being an advocate for freedom."
—Michelle Borquez, president of God Crazy Freedom, author of Overcoming the Seven Deadly Emotions
"We like to think that every marriage can be repaired and fully restored, but that's not reality in this fallen world. Kudos to Leslie Vernick for being one of the first to address this reality. I'll be recommending this book to many coaching clients in the coming years, because within these pages they'll discover so many valuable assets. I particularly love how she teaches women four steps to develop CORE strength, which helps them deal with their destructive partner in truth and with grace."
—Shannon Ethridge, MA, relationship coach, speaker, and best-selling author of Every Woman's Battle
About the Author
Product details
- Item Weight : 7.4 ounces
- Paperback : 240 pages
- Publisher : WaterBrook; 8/18/13 Edition (September 17, 2013)
- Product Dimensions : 5.2 x 0.64 x 7.98 inches
- Language: : English
Best Sellers Rank:
#13,862 in Books (See Top 100 in Books)
- #22 in Christian Pastoral Counseling
- #71 in Christian Marriage (Books)
- #144 in Marriage
- Customer Reviews:


text:
In 2007, the smash hit Happy Feet won the Academy Award for Best Animated Feature Film. So, it's certainly no surprise that writer/director George Miller and some of the voice cast returned for Happy Feet Two. This time around, Erik, the tiny son of master tap dancer Mumble (voiced by Elijah Wood) and the vocally gifted Gloria (voiced by Pink), runs away and encounters The Mighty Sven (Hank Azaria), the only penguin who can fly. When violent shifts in the glacial landscape of Antarctica threaten the survival of the entire Emperor penguin community, Mumble and Erik must rally all creatures, both great and small, to save them.
During a press conference to promote the film, George Miller talked about collaborating with tap master Savion Glover for the penguin choreography, the importance of following nature and natural history for the film's story, how despite our differences we can overcome the chaos of the world, what a privilege it was for him to see this voice cast working and recording together, and how he has no idea what the story for Happy Feet 3 could be, at this point. He also talked about his Justice League movie with Common as Green Lantern that never got off the ground, and whether Mad Max: Fury Road will ever actually happen. Check out what he had to say after the jump:
How did you collaborate with Savion Glover on the choreography for the penguins?
GEORGE MILLER: Well, the first thing to know is that I can't sing and I can't dance, so I had no right to be there. But, we had very, very good choreographers and people who really understand music, with the composer, John Powell, and the three choreographers – Wade Robson, who did the earlier material, Dein Perry, the creator of Tap Dogs, who did all the tapping later on, and Kate Wormald, who is also one of the motion capture performers for Gloria and Erik, and several others. In the center of that was Savion Glover, who came down for a week.
The first thing I had to understand about him is that he's a percussionist. He's a classic hoofer. He's a brilliant percussionist who uses his body for the percussion. I look at it and get dazzled, but I'm told by the musicians that he's working with such complex rhythms that it's almost mind-boggling. With a movie like this, you get a lot of wonderful material that you end up not able to use because you've essentially got 90 minutes to tell a story, but we would watch him dance for hours. I can tell you, if he's awake, whatever he's doing, his feet are tapping. To watch that sort of virtuosity was fantastic. The great privilege in doing this stuff is that the way the universe conspired to make these individuals, they have unique abilities that let them shine. To see that and to sort of have a say in what they would contribute is just very exciting to me and makes me feel a sense of wonder about being a human being. And, Savion Glover is the dance equivalent of that.
Why was it important to include the global warming message in the film, and what do you want audiences to take away from this?
MILLER: We tried to follow nature and natural history, as much as possible. All the creatures are designed, pretty strictly, to the anatomy of krill and elephant seals and penguins, and then we take the main characters and exaggerate them a bit. Even the behavior of the ice and snow and wind follows nature. I think that gives the film a lot more authenticity. You can't tell the story about this world without it being about the environment. It's the extremes of the planet, clearly. Any subtle change that we have is somehow recorded there, in the ice layers, because it's fixed. The animals that have died there are 100 years old and they almost look intact because it's a very, very cold climate. You can go down into the core of snow and ice in Antarctica and find every single volcano that ever happened in history, and every single nuclear accident. These massive icebergs are breaking off in the size of small countries, and they do block off the penguins. There are big shifts in the krill populations and where they are. There is melting on the peninsula, so the penguins are going south. The species are getting more mixed up.
That's what we tried to indicate in the movie. All of that is there, as part of the background narrative. For me, the guiding premise of the film is the notion that, despite our differences, we can overcome the chaos of the world. All the characters in the film are, in some way, are divided. Every single character is torn apart, and it's only when they come together that finally they can solve the problem. They can't even rely on the humans that arrive because they have to save themselves. The time I'm most proud of being a human being is when I see the coming together of people to solve their problems, or to endure the human adventure. All of that's in the film. I hope people can pick it up.
What was it like to bring this cast together and have them actually work together?
MILLER: That was thrilling to me. It's such a privilege to see guys like that, working together. It was just a wonderful thing. One of the memorable moments for me was when Hank [Azaria] had to do a serious scene, where Sven was basically confessing about himself. Everyone had finished their parts and it was just Hank by himself. And then, suddenly, Robin [Williams] and Elijah [Wood], and others who had gone out for a coffee break, came back into the room. And then, all of the cast came back and stood in front of Hank, without any mics, and just played a crowd. I was just choked up. I thought, "God, this is generosity." Everyone thinks movie stars are so narcissistic and self-absorbed, but it's totally the opposite. Their generosity is huge.
How did you go about selecting the songs that you used in the film?
MILLER: It came from a lot of different places. First of all, you're looking for something that fits the narrative. And then, the penguins and the other creatures are representative of us. John Powell is a composer who is really broad. He does everything from the Shrek movies to the Bourne movies, and he grew up in England playing in a Motown tribute band, and he trained classically because his father was a classical musician. He's very broad in his knowledge and musical taste. And then, we had Pink, who has three songs. We needed a song for the center of the movie, and she wrote that.
I had never heard "Under Pressure" before, but during the recording session, Hank [Azaria] said, "You know that song? It's like it was written for this." So, we've got that in there. The opera is an aria that I've always loved the structure of. It starts so quietly and it ends with such fervor, and I knew we needed to have Erik sing that song. When we were finishing the first Happy Feet, every time we would like a shot, they would push a button and "Rawhide" would play. One day, it came up with a shot of the elephant seals and I said, "Oh, if we ever make another one, it will be the elephant seals singing that." It comes from everywhere.
Do you have any ideas for a third film yet?
MILLER: If you put a gun to my head and said, "You have to come up with a story for Happy Feet 3," I'd say shoot me. I would have no idea. I really would have no idea. The stories creep up on you. You just have to allow the stories to come, and then they get in like little ear worms in your head and they won't go away. If that happens and we've got the energy, we'll do a third one. If it doesn't happen, it doesn't happen. That's the only way you can do it. It has to be authentic. I really wanted to make this film better than the first one. Otherwise, at my age, what's the point? You really want to make it better. If something comes up that's really exciting and I can convey that enthusiasm to other people, then there would be a third one.
Your animated films are great, but why haven't you done any live-action films for awhile?
MILLER: John Lennon said, "Life's what happens when you make other plans." Films keep on coming out of my head, and I never know what film I'm going to make next. Common and I were going to work on a Justice League movie together. He was cast as Green Lantern. It was almost greenlit, and then it fell away. I fell in love with the guy and called him up and said, "You can't play the Green Lantern, but how about playing a penguin?" And that was a whole bunch of complex events, in the middle of a writers' strike and Australian rebate legislation, which was required to get the film going. It was just a whole complex series of events. It was no one's particular fault that it happened. We were also due to do Happy Feet. These things are like big super-tankers, to start a pipeline like this, with over 600 or 700 people working on the film with the bleeding-edge of technology, where you're pushing technology as far as you can. We had to commit to that, so I went on to that.
When did Mad Max fit in there?
MILLER: I was about to do the next Mad Max film, Fury Road. We were all geared up for that, to shoot in the Australian desert, and then unprecedented rains came. What was the wasteland – completely flat, red earth – is now a flower garden. And the big, massive salt flats, where they do world record speed trials, is now full of pelicans and fish. Where the fish came from, I have no idea. So, we've lost the wasteland. Luckily, all of these films have been with Warner Bros., so it's been a very collaborative thing, going from one to the other.
Will Mad Max ever happen?
MILLER: Theoretically, it's next year. We have 150 big vehicles built. But, to be perfectly honest, [I just finished Happy Feet], and I'm not even there in my head, right now.

subset: commoncrawl


text:
161 members57 Comments 6 Likes
Gary J. Lambdin has not received any gifts yet
would look forward to hitting/playing with you. Let me know if you are interested. Intermediate level and just like hitting for fun as well. brian
Weather is nice. Happen to be on Long Island. Want to play today?
Hi, I'm Mark, the founder of Tennisopolis, the world's largest and most active tennis network. Please share Tennisopolis with your friends by supporting our Facebook page. Click here for a Guide to Meet Tennis Partners.
Have a look at our introduction page which will help you navigate the massive network which now has over 38,000 members and 500 local tennis groups.
Friend me,
Mark, The Mayor of Tennisopolis
© 2020 Created by Mark / The Mayor. Powered by


text:
You have no items in your shopping cart.
Mr. Serious vs. Said Kinos Wanderer backpack has a lining designed by Said Kinos. Bag to exploring the world and every day use.
Mr. Serious Wanderer backpack is made of grey multi-coloured 600D polyester with waterproof backing.
device compartment for a maximum of 15 inch laptop.• Side entrance for easy access to main compartment.• Chest trap for comfort.• Main compartment can be closed with zipper and buckles.• Front pocket is closed with zipper.• Back-panel and shoulder-straps are padded.• Size: 30x50x19cm, 28 litre capacity folded and 35 litre capacity used straight.
Reason to use: Bag is big and functional with slim tall design to carry your gear in a organised way.And get around comfortably when wandering around the globe.
Be the first to review this product
In Stock
Use spaces to separate tags. Use single quotes (') for phrases.


text:
How to Install Django on Ubuntu 16.04 - Django Tutorial
Oct, 16
How to Install Django? Django is a powerful Python Web framework that encourages rapid development and clean, pragmatic design. Built by experienced developers, it takes care of much of the hassle of Web development, so you can focus on writing your app without needing to reinvent the wheel. It's free and open source. In this article, we will be using Python version 3 for Django as recommended from the official Django site. To install python3-pip from the Ubuntu repository, use the...


text:
12 great free online courses.
Much ado has been made in recent years over the quickly rising cost of healthcare in the United States. But the cost of college tuition and fees has skyrocketed at nearly twice that rate. Going to college today will cost a student 559% more than it did in 1985, on average.
In an exciting talk given at TEDGlobal 2012, Stanford professor Daphne Koller explains why she was inspired — alongside fellow professor Andrew Ng — to create Coursera, which brings great classes from top universities online for free. Coursera classes have specific start dates, require students to take quizzes and turn in assignments, as well as allowing professors to customize their course into online chunks rather than simply recording their lectures.
When she spoke at TED Global, Coursera offered classes from four top colleges — Princeton University, the University of Michigan, Stanford University and the University of…
View original post 1,613 more words


text:
Welcome to the Academy of Court-Appointed Masters (ACAM) Organization
On this site, you will find information regarding:
How masters can help courts, lawyers, and parties in complex litigation. The various roles special masters ably serve in federal and state courts. How masters substantially reduce litigation expenses for parties. Sample appointment orders lawyers may submit and judges may enter. How masters readily assist judges to fulfill their judicial obligations while saving judges and court personnel substantial amounts of time.
ACAM is an independent organization of experienced masters who serve in both federal and state courts. Our mission is to provide judges, lawyers, parties, and other masters with helpful information regarding the use of masters. Membership is open to any master who has been appointed by a federal or state court judge.
We invite you to use our website and send us any comments or suggestions you have about court-appointed masters.
Thank you to our Annual Meeting Sponsors!


text:
As reported on the MidContinental Region News blog:
Tune in Tuesday, Nov. 16, at 9am MT, 1-am CT, as Professional Development Award winner, Lenora Kinzie presents. Lenora received funding from the NN/LM MCR to attend Supporting Clinical Care: An Institute in Evidence-Based Practice for Medical Librarians at Dartmouth College in August 2010. She will share her experiences along with tidbits and tips she learned while attending the conference. Topics will include PICO, Gray Literature, Clinical Queries, Trip Database and other Evidence-Based Resources.
To access this presentation:
- URL: https://webmeeting.nih.gov/mcr/ (note the "s" in the address)
- Equipment: connection to the Internet and a phone.
- Login: as a guest with your first and last name. Instructions to connect to the audio will show up once you've logged in. Captioning will be provided. Questions to email@example.com.


text:
Wednesday, January 28, 2004
Bay Auction for "The Best Sr. Network/Security Engineer"
"You are bidding on myself to work at your company.
I will relocate at my expense and honor any offers received through eBay or otherwise.
Here is my information.
Over 15 years of extensive experience in the Information Technology Industry. Strengths are in networking, security, firewalls, LAN/WAN, Web Server, Application Server, SQL Server, and Oracle Server technologies including infrastructure design, integration, implementation, performance testing, problem resolution, security and network design, Firewall and IDS Implementation using a variety of platforms and products as well as, managerial and strong leadership skills."
The "buy it now" price is $100,000 and the starting price is $50,000. Hurry! The auction ends Jan-30-04 11:57:37 PST.
US-CERT National Cyber Alert System
"The new National Cyber Alert System security suite of products includes:
Cyber Security Tips: Targeted at non-technical home and corporate computer users, the bi-weekly Tips provide information on best computer security practices and "how-to" information.
Cyber Security Bulletins: Targeted at technical audiences, Bulletins provide bi-weekly summaries of security issues, new vulnerabilities, potential impact, patches and work-arounds, as well as actions required to mitigate risk.
Cyber Security Alerts: Available in two forms - regular for non-technical users and advanced for technical users - Cyber Security Alerts provide real-time information about security issues, vulnerabilities, and exploits currently occurring. Alerts encourage all users to take rapid action."
Another Internet Explorer Hole
"This hole could easily be combined with another Explorer spoofing problem discovered in December.
The previous spoofing problem allowed Explorer users to think they were visiting one site when in fact they were visiting somewhere entirely different. The implications are not only troublesome, but Microsoft's failure to include a fix for the problem in its January patches has led many to believe it cannot be prevented.
If the same is true for this spoofing issue, then it will only be a matter of time before someone who thinks they are visiting one website and downloading one file will in fact be visiting somewhere entirely different and downloading whatever that site's owner decides.
We also have reason to believe there is no fix. It may be that today's flaw is identical to one found nearly three years ago by Georgi Guninski in which double-clicking a link in Explorer led you to believe you were downloading a text file but were in fact downloading a .hta file.
In both cases, the con is created by embedding a CLSID into a file name. CLSID is a long numerical string that relates to a particular COM (Component Object Model) object. COM objects are what Microsoft uses to build applications on the Internet. By doing so, any type of file can be made to look like a "trusted" file type i.e. text or pdf.
Guninski informed Microsoft in April 2001. The fact that the issue has been born afresh suggests rather heavily that the software giant has no way of preventing this from happening. "
This is ridiculous. How long will corporate America tolerate this before abandoning Internet Explorer for Mozilla? Unfortunately, in complete violation of all good software design principles, IE is tightly integrated into the Windows desktop. Running Mozilla is only part of the solution. Abandoning Microsoft for Mac OS X on the desktop is a better idea. I run FreeBSD 5.2 on my laptop but that's not the best idea for normal consumers.
For another essay on fundamental Windows flaws, read Shatter Attacks - How to Break Windows.
Sunday, January 25, 2004
Installing a Single Port
moog# ls -al /usr/ports/INDEX*
-rw-r--r-- 1 root wheel 4003057 Oct 2 16:55 /usr/ports/INDEX
-rw-r--r-- 1 root wheel 4036779 Aug 15 21:56 /usr/ports/INDEX-5
I visited /ports/net/gnetcat and chose the download this directory in tarball option. This copied gnetcat.tar.gz to my system, and I moved it to /usr/local/ports/net. Next I extracted it and ran make and make install:
moog# tar -xzvf gnetcat.tar.gz
moog# cd gnetcat
moog# make && make install
>> netcat-0.7.1.tar.bz2 doesn't seem to exist in /usr/ports/distfiles/.
>> Attempting to fetch from http://us.dl.sourceforge.net/netcat/.
Receiving netcat-0.7.1.tar.bz2 (325687 bytes): 45%
When done I did a "rehash" and found gnetcat on my system:
moog# rehash
moog# which gnetcat
moog# gnetcat -h
GNU netcat 0.7.1, a rewrite of the famous networking tool.
Basic usages:
connect to somewhere: gnetcat [options] hostname port [port] ...
listen for inbound: gnetcat -l -p port [options] [hostname] [port] ...
tunnel to somewhere: gnetcat -L hostname:port -p port [options]
Mandatory arguments to long options are mandatory for short options too.
-c, --close close connection on EOF from stdin
-e, --exec=PROGRAM program to exec after connect
-g, --gateway=LIST source-routing hop point[s], up to 8
-G, --pointer=NUM source-routing pointer: 4, 8, 12, ...
-h, --help display this help and exit
-i, --interval=SECS delay interval for lines sent, ports scanned
-l, --listen listen mode, for inbound connects
-L, --tunnel=ADDRESS:PORT forward local port to remote address
-n, --dont-resolve numeric-only IP addresses, no DNS
-o, --output=FILE output hexdump traffic to FILE (implies -x)
-p, --local-port=NUM local port number
-r, --randomize randomize local and remote ports
-s, --source=ADDRESS local source address (ip or hostname)
-t, --tcp TCP mode (default)
-T, --telnet answer using TELNET negotiation
-u, --udp UDP mode
-v, --verbose verbose (use twice to be more verbose)
-V, --version output version information and exit
-x, --hexdump hexdump incoming and outgoing traffic
-w, --wait=SECS timeout for connects and final net reads
-z, --zero zero-I/O mode (used for scanning)
Remote port number can also be specified as range. Example: '1-1024'
I plan to test gnetcat to see how it compares to the original nc.
Review of Introduction to Microprocessors Posted
"John Crisp's Introduction to Microprocessors (ITM) is an excellent book. It has a low average score because the author posted the first review with zero stars, which could be the result of an Amazon.com error. I loved this book. It gets right to the heart of the matter regarding the operations of microprocessors. Anyone who wants to really know what happens inside their CPU will love ITM too."
I learned a second edition was just published, so I hope to read and review that book soon.
Friday, January 23, 2004
Blogger is "Atom-Enabled"
I first tried NewsMonster which integrates with Mozilla and supposedly supports Atom, but encountered an error when trying to run it.
I next tried BottomFeeder, and found the precompiled Linux version worked fine using FreeBSD's Linux application binary interface (ABI). If you use BottomFeeder to access http://taosecurity.blogspot.com/atom.xml, you'll see the screen shot at left.
Monday, January 19, 2004
Review of Intrusion Detection and Prevention Posted
"I had high hopes for "Intrusion Detection and Prevention" (IDAP) as it is the first book to devote chapters to different vendor IDS products. It's also the first to explicitly mention the buzzword "intrusion prevention" in its title. Unfortunately, the book does not deliver the value I expected...
I took exception to some of the authors' conclusions. (Keep in mind a team wrote this book.) A cheap shot on page 187 shows the ISS chapter author doesn't understand what real analysts need to "trust" their IDS: "These increases in product signatures have given more customers the capability to trust the comprehensive nature of RealSecure over every other product, including the freeware power player, Snort." Analyst trust is built on transparency and validation, meaning he can see why the product generated an alert, and use additional data to confirm its validity. Snort and NFR offer this; ISS does not. Furthermore, if you don't like how Snort works, you can modify the source code -- try that with a proprietary system."
Sunday, January 18, 2004
Using Sysctl on FreeBSD
The replies in the thread reported using sysctl to change kernel state. How could you figure this out if you didn't know the appropriate variable to change?
First, use grep with sysctl to see if any variables involve ARP:
bash-2.05b$ sysctl -a | grep -i arp
net.link.ether.inet.log_arp_wrong_iface: 1
net.link.ether.inet.log_arp_movements: 1
These look interesting. What do they mean?
bash-2.05b$ sysctl -d net.link.ether.inet.log_arp_wrong_iface
net.link.ether.inet.log_arp_wrong_iface: log arp packets arriving on the wrong interface
bash-2.05b$ sysctl -d net.link.ether.inet.log_arp_movements
net.link.ether.inet.log_arp_movements: log arp replies from MACs different
than the one in the cache
We can disable either of these variables using syntax like the following:
bash-2.05b$ sudo sysctl net.link.ether.inet.log_arp_wrong_iface=0
net.link.ether.inet.log_arp_wrong_iface: 1 -> 0
You can set it back to the default by setting the value=1. To make this a permanent change, make the following entry in the /boot/loader.conf:
net.link.ether.inet.log_arp_wrong_iface: 1
Friday, January 16, 2004
BSD for Linux Users
"The concept of the "base system" is something that, I think, causes the most trouble for people used to the Linux methodology. Which is perfectly understandable, because the whole idea just doesn't even exist in the Linux world.
Linux, from the start, was just a kernel. Without getting into the eternal debate of what an "operating system" precisely consists of, it's easy to state that a kernel by itself isn't very useful. You need all the userland utilities to make it work. Linux has always been a conglomerate; a kernel from here, a ls from there, a ps from this other place, vim, perl, gzip, tar, and a bundle of others.
Linux has never had any sort of separation between what is the "base system" and what is "addon utilities". The entire system is "addon utilities". MySQL is no different from ls from KDE from whois from dc from GnuCash from ... Every bit of the system is just one or another add-on package.
By contrast, BSD has always had a centralized development model. There's always been an entity that's "in charge" of the system. BSD doesn't use GNU ls or GNU libc, it uses BSD's ls and BSD's libc, which are direct descendents of the ls and libc that where in the CSRG-distributed BSD releases. They've never been developed or packaged independently. You can't go "download BSD libc" somewhere, because in the BSD world, libc by itself is meaningless. ls by itself is meaningless. The kernel by itself is meaningless. The system as a whole is one piece, not a bunch of little pieces."
He explains the ports tree:
"The difference between ports and RPM's isn't just that ports compile and RPM's just install. Ports are designed to cover the full range of bits and pieces of installing stuff; encoding and tracking and installing dependencies, packaging, installing and deinstalling, local changes necessary to build on your system, compile-time configuration tweaks... all those things. An RPM is just a binary package. If you want to auto-install dependencies, you have to have a higher-level tool like urpmi or apt-get to do it. And, since it's binary, you have to deal with library versioning conflicts, or missing compile options, or any of the other limitations you incur by not building it on your own system.
And further, ports, like the rest of the BSD systems, are centralized... all those files in that big directory tree are maintained by the FreeBSD project itself. When somebody wrote KDE, for instance, it didn't magically appear in ports trees everywhere. Somebody had to write all the necessary "glue" to build a port for it, then commit the files into the FreeBSD CVS repository so it would be in the ports collection. So again, there's some level of assurance that it works with other things in the ports collection. Any dependencies it has will be there, because it can't declare a dependency on something not in ports."
He also talks about release engineering:
"In a very real sense, BSD systems are constantly developed; I can always update my system to the absolute latest code, irrespective of "releases". In Linux, that doesn't really have as much meaning, because the release process is very different. I think the most appropriate verb for a Linux release is "assembled". A Linux release is assembled from version A.B of this program, plus version C.D of this program, plus version E.F of this program... all together with version X.Y.Z of the Linux kernel. In BSD, however, since the pieces are all developed together, the verb "cut" makes a lot more sense; a release is "cut" at a certain time."
I highly recommend reading this article.
Microsoft Provides Mozilla 1.6?
Thursday, January 15, 2004
Network Sorcery Protocol Reference
- Network layer protocols are assigned EtherTypes, like 0x0806 for ARP, 0x0800 for IPv4, and 0x86DD for IPv6.
- Transport layer protocols are assigned IP protocol values, like 1 for ICMP, 6 for TCP, 17 for UDP, 132 for Stream Control Transmission Protocol, and so on.
- Application layer protocols are assigned one or more SCTP, TCP or UDP port numbers, like 23 for Telnet, 80 for HTTP, and so on.
Most people argue about what protocols do and forget how they are carried. I like the way Network Sorcery cuts through this issue.
Besides describing all of these protocols and showing their header formats, Network Sorcery also links to the RFCs defining their operation.
Tuesday, January 13, 2004
Installing FreeBSD 5.2 REL on the Thinkpad a20p
Here are a few tweaks to get the system working:
I enabled sound with these entries in /boot/loader.conf
I enabled my SMC wireless NIC with this entry in /etc/rc.conf:
ifconfig_wi0="inet 192.168.2.3 netmask 255.255.255.0
ssid myssid wepkey 0xmywepkeyinhex wepmode on"
My biggest challenge and favorite achievement was getting Java to work properly. A visit to the FreeBSD Foundation Java site showed it was behind the times. It did give me a pointer to the FreeBSD-Java mailing list, which would prove to be invaluable. I eventually found FreeBSDDom and their patch sets of the Sun JDKs. I also read about the FreeBSD Java Project's work.
I decided to give the /usr/ports/java/jdk14 port a try. I saw it used the 1.4.2p5 patch set, so I downloaded it to /usr/ports/distfiles. Next I downloaded the following and also placed them in /usr/ports/distfiles:
The first three were available at the Sun Java 2 Download site. The last was in a different section, but it can be found here (or more generically, here).
Then, within /usr/ports/java/jdk14, I executed:
make install
Along the way I received some messages which prompted me to act:
This Java VM will attempt to obtain some system information by
accessing files in linux's procfs. You must install the Linux
emulation procfs filesystem for this to work correctly. The JVM
will exhibit various problems otherwise. This can be accomplished
by adding the following line to your /etc/fstab file:
linprocfs /compat/linux/proc linprocfs rw 0 0
and then, as root, executing the commands:
kldload linprocfs
mount /compat/linux/proc
I did as the instructions warned. At one point the installation stopped with this error:
ERROR: JAVAWS_BOOTDIR does not point to a valid Java 2 SDK
Check that you have access to
and/or check your value of ALT_JAVAWS_BOOTDIR.
ERROR: BOOTDIR does not point to a valid Java 2 SDK
Check that you have access to
and/or check your value of ALT_BOOTDIR.
Exiting because of the above error(s).
gmake: *** [post-sanity] Error 1
I realized I needed to install the linux-sun-jdk14 port so I took these actions:
cd /usr/ports/java/linux-sun-jdk14/
make && make install
After that I returned to the /usr/ports/java/jdk14 directory, executed 'make', and continued installing the JDK. I received instructions on additions to my XF86Config file:
URW font collection for X.
You'll have to add /usr/X11R6/lib/X11/fonts/URW
to your X font path by either:
$ xset fp+ /usr/X11R6/lib/X11/fonts/URW
$ xset fp rehash
or by adding it to your X-server configuration file
I made the change as apparent in my XF86Config file. Once the JDK installation finished, I added Mozilla as a package. To get Mozilla to work with Java, I added the following symlink:
mkdir /usr/X11R6/lib/browser_plugins
ln -s /usr/local/jdk1.4.2/jre/plugin/i386/ns610/libjavaplugin_oji.so
At this point I thought I was ready to go, but Java refused to work. Thanks to a FreeBSD-Java thread, I learned the JDK didn't work well with IPv6. I disabled IPv6 by a sysctl command and made the appropriate entry in /etc/sysctl.conf:
sysctl net.inet6.ip6.v6only=0
echo "net.inet6.ip6.v6only=0" >> /etc/sysctl.conf
When I fired up Mozilla, I was able to see the Java security news plug-in worked.
The last challenge was setting up OpenOffice.org. Luckily I found precompiled packages for FreeBSD 5.2 REL. Here are the highlights:
pkg_add -v openoffice-1.1.0_1.tbz
Requested space: 306061008 bytes, free space: 4291790848 bytes
in /var/tmp/instmp.TMcvUV
dckage openoffice-1.1.0_1 registered in /var/db/pkg/openoffice-1.1.0_1
OpenOffice.org Build 1.1.0 Personal Install How-To
Written by: Martin Blapp
There are some wrappers installed for fast startup.
Add "${PREFIX}/bin/" to your PATH and you will be able
to use them.
If you have chosen US-ASCII as locale, you cannot load
and save documents with special characters and these
characters are also not available in swriter and scalc.
I ran 'openoffice-1.1' and chose 'local installation'. I specified '/usr/local/jdk1.4.2/jre' for my Java Runtime Environment, and OO found jdk1.4.2-p5 and used it. When I was done with the installation process, I reran 'openoffice-1.1', and found myself inside OO.
Aside from the length of time it took to install Java, the process worked very well.
My last work for the day involved checking to see if the laptop could suspend. I had downloaded and used IBM's stndalhd.exe program prior to installing FreeBSD to create a suspend partition. It created a partition of type 160 decimal or 0xa0. Unfortunately it did not create the partition table properly, as my first install of FreeBSD complained during setup and then refused to boot when done. I scrapped the old partition table and created a partition type 160 inside FreeBSD's fdisk during the FreeBSD installation. Once FreeBSD was installed I used newfs_msdos to create a FAT partition for my suspend work.
I allowed FreeBSD to boot with ACPI enabled. By experimenting I found I could suspend the laptop with acpiconf:
- turn off laptop: 'acpiconf -s 5'
- suspend to disk: 'acpiconf -s 3'
- wake up from suspend: 'Fn' key or raise cover after 'acpiconf -s 3' and closing cover
I found 'shutdown -h now' didn't work completely with ACPI, and shutting the laptop cover had no effect. When I return from a suspend, I have to reinitialize wi0 and HUP moused. The built-in NIC, fxp0, works fine after suspending.
Overall I'm really pleased with this new FreeBSD distro and I'm using it as my primary system.
Update: I've decided to abandon ACPI. I boot with ACPI disabled and use the Fn-F4 key to suspend the laptop. When it resumes I re-ifconfig any needed interface and run ntpdate to bring the system clock up to speed.
I installed xmms and mplayer. After a fresh reboot each works, but after resuming from suspending neither works. This appears to be a hardware issue as others report having the same problem with Linux.
Monday, January 12, 2004
FreeBSD 5.2 Released Today!
I was sad to see Slashdot repeated last year's debacle with FreeBSD 5.0 by posting news of the "release" prior to the official annoucement. What's wrong with them?
I encourage all FreeBSD users to support the project by buying a CD-ROM or T-shirt from FreeBSDMall. I've started buying copies of the releases, and for less than $40 you get four CDs. They include the install CD, and live CD-based distro, and two CDs of precompiled packages. The polo shirt pictured at left is really sharp too, not a flimsy piece of clothing.
Laptopsforless.com Laptop Parts
TCP Sequence Numbers Explained
The following excerpt from my upcoming book The Tao of Network Security Monitoring explains how TCP sequence and acknowledgement numbers work by following a TCP session through Ethereal:
This brief section uses Ethereal screen captures to definitively explain TCP sequence numbers. 192.168.2.4 is a workstation named "caine" and 184.108.40.206 is ftp.netbsd.org, contracted to "netbsd" here.
Packet 1 shows a SYN from caine to netbsd. The TCP segment's ISN is 1664882716. The hexadecimal shorthand is highlighted. Directly to the right of the ISN is a 4 byte value of zeroes. This is where the acknowledgement number would reside, if the ACK flag were set.
Packet 2 shows a SYN ACK from netbsd to caine. Netbsd sets a Initial Response Number of 829007135 and an ACK value of 1664822717. The ACK value is highlighted in the figure. ACK 1664822717 indicates that the next real byte of application data netbsd expects to receive from caine will be number 1664822717. That ACK value also indicates netbsd received a "byte of data" implied in the SYN packet caine sent, whose ISN was 1664822716. No bytes of data were actually sent. This is an example of a sequence number being "consumed" in the three-way handshake.
Packet 3 shows the completion of the three-way handshake. Caine sends an ACK 829007136, which acknowledges receipt of the one "byte of data" implied in the SYN ACK packet netbsd sent, whose IRN was 829007135. 829007136 indicates that the first real byte of data caine expects to receive from netbsd will be number 829007136. Again, no bytes of application data have actually been sent by either party. This is another example of a sequence number being "consumed" in the three-way handshake.
Packet 4 shows the first real bytes of application data sent from netbsd to caine. Netbsd still sends ACK 1664882717 because that is the sequence number of the first real byte of application data netbsd expects to receive from caine. Netbsd's sequence number is 829007136, meaning the first byte of application data in packet 4 is numbered 829007136. That is the byte with hexadecimal value 0x32, which is ASCII 2 of the first digit in the "220" status code sent by Netbsd's FTP service. You can see "32 32 30" in the line below the highlighted acknowledgement number in the screen capture.
Observe that this packet bears a sequence number indicating the sequence number of the first byte of application data in the packet. The value of this sequence number bears no relationship with the amount of application data in the packet. If netbsd sends 58 bytes or 580 bytes, it still uses sequence number 829007136, because that is the number of the first byte of data it promised to send to caine.
Ethereal reports the "next sequence number" to be 829007194. This value does not specifically appear anywhere in the packet. It is calculated by adding the number of bytes of application data in the packet (58) to the sequence number of the first byte of data in the packet (829007136). This does not mean the last sequence number of data in this packet is 829007194. Rather, the sequence number of the last byte of data is 829007193. How is this so? The following table tracks the sequence numbers of the bytes of application data in this packet.
|Sequence Number
|Hex Rep
|...50 bytes omitted...
|carriage return
|new line
This fact probably accounts for most of the misunderstandings regarding the relationship between sequence numbers and byte counts of application data.
Packet 5 shows caine acknowledges receipt of bytes 829007136 through 829007193 from netbsd by sending ACK 829007194. This means the next byte of application data caine expects to receive from netbsd will be number 829007194. Caine's own sequence number 1664882717 is unchanged as it has not yet sent any application data.
Packet 6 shows netbsd sending more data to caine. The "next sequence number field" is highlighted to show there is no corresponding real field in the TCP header of the bottom pane. The value 829008140 means netbsd sent 946 bytes of application data. Netbsd sets its sequence number as 829007194 to represent the first byte of data in this packet. The sequence number of the last byte of application data is 829008139. Its acknowledgement number remains at 1664882717 because caine still has not sent any application data.
Packet 7 shows caine acknowledges receipt of 946 bytes of application data with an ACK 829008140. This means the last byte of data caine received was number 829008139. Caine expects to receive 829008140 next from netbsd. Caine's sequence number is still set at 1664882717 because it has not yet sent any application data to netbsd.
In packet 8 caine finally sends its own application data to netbsd. Caine transmits 11 bytes, starting with sequence number 1664882717 (0x55, or ASCII U) and ending with 1664882727 (0x0a, or new line). Caine's acknowledgement number stays at 829008140 because that is the number of the next byte of application data caine expects from netbsd. Should caine send more application data, the first byte will be number 1664882728, as depicted in the "next sequence number" calculated by Ethereal.
As we saw earlier when netbsd sent application data, the sequence number carried in the packet is the number of the first byte of application data. Here it is 1664882717, which is what caine promised to send netbsd way back in packet 2.
Packet 9 shows netbsd acknowledges bytes 1664882717 through 1664882727 by sending an ACK 1664882728. Netbsd sends 45 bytes of its own application data, demonstrating that TCP allows acknowledging data sent by another party while transmitting new data to that party.
By now you should have a good understanding of how TCP sequence numbers work. We skip packets 10, 11, and 12 as they offer nothing new in terms of watching sequence numbers. Packet 13 begins the TCP "graceful close" or "orderly release," by which each side of the conversation closes the session. We can inspect the one-line summary of the sequence and acknowledgement numbers in the next screen shot to follow the closing of the session.
Packet 13 shows netbsd terminates the session by sending a FIN ACK packet. Netbsd sets its ACK number at 1664882734, indicating it has received bytes of data through 1664882733 from caine. Packet 13 bears a sequence number of 829008199.
Packet 14 shows caine's response, an ACK 829008200. This acknowledges receipt of the "byte of data" implied by packet 13 from netbsd. This is similar to the way sequence numbers were "consumed" during the three-way handshake to confirm acknowledgement of SYN and SYN ACK packets. Packet 14 is caine's way of saying it received the FIN ACK from netbsd.
Packet 15 is caine's own FIN ACK. Caine uses ACK 829008200, the same as it used in packet 14. Caine sets its own sequence number at 1664882734. Netbsd will use this as the basis for its own acknowledgement in packet 16.
Why doesn't caine combine packets 14 and 15 into a single FIN ACK? The reason lies with the work being done at different levels of the OSI model. Packet 14 shows the TCP layer talking. By immediately replying with an ACK to netbsd's FIN ACK, caine indicates its receipt of packet 13. Caine's TCP/IP stack then needs to check with its FTP client application to see if it has any more application data to send. When the stack learns the FTP client is done with the session, caine sends its own FIN ACK in packet 15.
Packet 16 is netbsd's acknowledgement of caine's FIN ACK. Netbsd sets its ACK value to 1664882735, indicating it received the "byte of data" implied by packet 15 from caine. This is another consumption of a sequence number used to complete the TCP graceful close.
I hope this helps dispel the fog surrounding TCP sequence numbers.
New Taps from NetOptics
Shortly I hope to try NetOptics new 10/100BaseT Port Aggregator Tap. This device has a single output, which removes the need for combining two TX outputs. Unlike a competitor's product, the Aggregator Tap specifically addresses the issues of combining streams which may exceed 100 Mbps:
"For cases where the NIC's capacity is exceeded – for instance, if there is a traffic burst, and the 100 Mbps NIC is now receiving 140 Mbps of traffic – port buffering is offered as an additional innovative feature to help prevent data overload. Buffered memory handles an overflow of up to one megabyte per side of the full-duplex connection. This memory clears automatically once the NIC's utilization is again below 100 percent."
NetOptics also plans to move the product to a PCI-based platform:
"Offered first in 10/100 models, Port Aggregator Taps will be available in a variety of configurations, including a standard rack-mount model, or a PCI-based unit designed for direct insertion into monitoring hardware. Port Aggregator Taps may also be ordered with active response capability, enabling injection of responses such as TCP resets back into the original network link."
Saturday, January 10, 2004
A FreeBSD Kernel Module for Generating NetFlow Records
I tested ng_netflow on a FreeBSD 4.9 system named janney, with IP address 172.27.20.5. To use ng_netflow, download the archive and extract it. Change into the ng_netflow-0.1 directory and execute 'make'.
janney# tar -xzf ng_netflow-0.1.tar.gz
janney # cd ng_netflow-0.1
janney # ls
CVS Makefile flowctl
ChangeLog README ng_netflow
janney # make && make install
===> ng_netflow
install -o root -g wheel -m 555 ng_netflow.ko /modules
install -o root -g wheel -m 444 ng_netflow.4.gz /usr/share/man/man4
===> flowctl
install -s -o root -g wheel -m 555 flowctl /usr/local/sbin
install -o root -g wheel -m 444 flowctl.8.gz /usr/share/man/man8
To enable the kernel module, use the following syntax. Note it differs from the man page, which has errors. Interface em0 is the interface which will listen for traffic to be represented as NetFlow data. 172.27.20.3 is the NetFlow collector, bourque.
janney# kldload ng_ether
janney# kldload ng_tee
janney# kldload ng_netflow
janney# ngctl -f - << EOF
? mkpeer em0: tee lower right
? connect em0: em0:lower upper left
? mkpeer em0:lower netflow right2left iface0
? name em0:lower.right2left netflow
? msg netflow: setifindex { iface=0 index=1 }
? mkpeer netflow: ksocket export inet/dgram/udp
? msg netflow:export connect inet/172.27.20.3:4444
You can check the status of the ng_netflow kernel module with the following command:
janney# flowctl netflow show
SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts
em0 192.168.1.2 em0 192.168.1.1 6 03f8 006f 5
These results show flows between 192.168.1.1 and 192.168.1.2. These are the IP addresses in the lab system for which monitoring interface em0 on janney has visibility. Once enabled, and traffic is flowing past the em0 interface on janney, the ng_netflow probe will emit NetFlow records to the collector. We verify this with Tcpdump on the collector, bourque:
bourque# tcpdump -n -s 1515 -i fxp0 -X port 4444
tcpdump: listening on fxp0
08:15:08.271115 172.27.20.5.1064 > 172.27.20.3.4444: udp 72
0x0000 4500 0064 0842 0000 4011 f208 ac1b 1405 E..d.B..@.......
0x0010 ac1b 1403 0428 115c 0050 f86c 0005 0001 .....(.\.P.l....
0x0020 0000 03c5 3ffe a98c 0004 df9c 0000 0000 ....?...........
0x0030 0000 0000 c0a8 0102 c0a8 0101 0000 0000 ................
0x0040 0001 0001 0000 0001 0000 0054 0000 03b2 ...........T....
0x0050 0000 03b2 0000 0000 0000 0100 0000 0000 ................
0x0060 1818 0000 ....
As you can see, janney (172.27.20.5) is emitting NetFlow records to port 4444 UDP on 172.27.20.3. Now you need to use something like Flow-captire to collect the records.
flow-capture -w /nsm/netflow/ng_netflow/test/ 0/0/4444
We use Flow-cat and Flow-print to see the records:
bourque# flow-cat * | flow-print | less
srcIP dstIP prot srcPort dstPort octets packets
192.168.1.2 192.168.1.1 6 1023 111 312 5
192.168.1.2 192.168.1.1 6 1022 111 312 5
192.168.1.2 192.168.1.1 6 1021 111 312 5
192.168.1.2 192.168.1.1 17 1023 111 84 1
192.168.1.2 192.168.1.1 6 1020 1023 312 5
192.168.1.2 192.168.1.1 17 1020 111 84 1
192.168.1.2 192.168.1.1 17 1022 111 84 1
192.168.1.2 192.168.1.1 17 1019 1023 156 1
192.168.1.2 192.168.1.1 17 1021 2049 68 1
192.168.1.2 192.168.1.1 17 1018 2049 6204 42
192.168.1.2 192.168.1.1 6 1019 111 312 5
192.168.1.2 192.168.1.1 6 1018 111 312 5
192.168.1.2 192.168.1.1 17 1017 111 84 1
192.168.1.2 192.168.1.1 17 1016 1023 156 1
192.168.1.2 192.168.1.1 17 1018 2049 9053528 56586
I personally prefer to work with Argus data, but many sites have extensive NetFlow-based monitoring systems.
If you prefer to implement a user-land NetFlow probe, try Fprobe, in the ports tree at /usr/ports/net/fprobe.
Fprobe allows a standalone NSM platform to export NetFlow records just as a Cisco router would. It's an application installed on a server which listens for traffic and generates NetFlow records based on what it sees. Fprobe is a good alternative for analysts who want to create NetFlow data without adding to the processing load of their router, or whose routers don't support NetFlow due to lack of memory or an old Cisco IOS version.
The following command tells Fprobe to listen on the ngeth0 monitoring interface and export NetFlow data to a collector on port 2055 UDP at 172.27.20.3:
/usr/local/bin/fprobe -i ngeth0 –f ip 172.27.20.3:2055
The default export format is NetFlow v5, although Fprobe also supports versions 1, 5, and 7. The "-f ip" switch tells Fprobe to use the Berkeley Packet Filter "ip" as a filter. Although the –f switch is optional, the Fprobe manpage advocates its use. In the configuration I use, I have Fprobe run on the NSM platform and export NetFlow data to a collector also running on the NSM platform.
We read the Fprobe records using the Flow-tools just as we did for ng_netflow.
Friday, January 09, 2004
rying Tenable's NeWT Security Scanner
Within minutes I was scanning one of the other systems on the same class C as my laptop. NeWT has a very "Windows Update" or Microsoft Baseline Security Analyzer feel to it. It's easy to configure and navigate, and the report results were clear.
NeWT is a Windows port of the Nessus engine. Currently the open source version of the Nessus server is UNIX-only, with clients for configuring scans available for Windows or UNIX. NeWT brings the power of Nessus to those preferring to scan from a Windows platform.
Tenable sells two versions of NeWT: one for $500, and one for $3000, with varying IP restrictions. Check out the NeWT home page for more information.
Thursday, January 08, 2004
Using Device Polling and More to Improve Packet Capture
"An explanation for the poor performance figures is something called interrupt livelock. Device drivers instrument network cards to generate an interrupt whenever the card needs attention (e.g. for informing the operating system that there is an incoming packet to handle). In case of high traffic rate, the operating system spends most of its time handling interrupts leaving little time for other tasks. A solution to this problem is something called device polling."
FreeBSD has had device polling available in the kernel since FreeBSD 4.5 REL, but you need to recompile the kernel and use a polling-aware NIC. From /usr/src/sys/i386/conf/LINT on my 4.9 REL box:
# DEVICE_POLLING adds support for mixed interrupt-polling handling
# of network device drivers, which has significant benefits in terms
# of robustness to overloads and responsivity, as well as permitting
# accurate scheduling of the CPU time between kernel network processing
# and other activities. The drawback is a moderate (up to 1/HZ seconds)
# potential increase in response times.
# It is strongly recommended to use HZ=1000 or 2000 with DEVICE_POLLING
# to achieve smoother behaviour.
# Additionally, you can enable/disable polling at runtime with the
# sysctl variable kern.polling.enable (defaults off), and select
# the CPU fraction reserved to userland with the sysctl variable
# kern.polling.user_frac (default 50, range 0..100).
# Only the "dc" "fxp" and "sis" devices support this mode of operation at
# the time of this writing.
options DEVICE_POLLING
However, the man page says other cards are supported, including the important em Gigabit Ethernet driver.
Polling requires explicit modifications to the device drivers. As of
this writing, the dc(4), em(4), fxp(4), rl(4), and sis(4) devices are
supported, with other in the works. The modifications are rather
straightforward, consisting in the extraction of the inner part of the
interrupt service routine and writing a callback function, *_poll(),
which is invoked to probe the device for events and process them. See
the conditionally compiled sections of the devices mentioned above for
more details.
According to Luca, the new Linux 2.6 kernel supports polling as well. He re-ran his tests against Linux kernel 2.6 and FreeBSD 4.8 (polling enabled). Linux with standard libpcap now captured 5.6% of traffic while FreeBSD captured 99.9%. (That's my boy!) When Linux implemented capture using a kernel module, Linux's performance matched FreeBSD at 99.5%.
Not happy with this outcome, Luca modified the Linux Gigabit driver and wrote patches to create a ring-buffer based version of libpcap. He found this works much better and plans to port it to FreeBSD as well.
Update: I asked the community to provide opinions on this paper. You can read the thread at unix.derkeiler.com. The netbsd-tech-kern list hotly debated this paper in this thread.
Update: On 20 Feb 04 Luca released a significantly modified version of the paper at the same URL. The big issue for FreeBSD seems to be poor performance with higher packet sizes.
Happy 1st Birthday TaoSecurity Blog
I decided today to try to get VMWare 3.x working fully within FreeBSD, so I installed the VMWare3 port (version vmware3 220.127.116.112-2) on my FreeBSD 4.9 STABLE system. First I made this change as recommended by the port install directions:
janney# sysctl kern.ipc.shm_allow_removed=1
kern.ipc.shm_allow_removed: 0 -> 1
I then added this line to /etc/sysctl.conf to enable this at boot time:
I then mounted linproc:
janney# mount_linprocfs linproc /compat/linux/proc
janney# mount
/dev/amrd0s1a on / (ufs, NFS exported, local)
/dev/amrd0s1h on /home (ufs, local, soft-updates)
/dev/amrd0s1g on /tmp (ufs, local, soft-updates)
/dev/amrd0s1e on /usr (ufs, local, soft-updates)
/dev/amrd0s1f on /var (ufs, local, soft-updates)
procfs on /proc (procfs, local)
linprocfs on /usr/compat/linux/proc (linprocfs, local)
I added this line to /etc/fstab to enable this at boot time:
linprocfs /usr/compat/linux/proc linprocfs rw 0 0
I executed '/usr/local/etc/rc.d/vmware.sh start' and saw it created a new pseudo-interface:
vmnet1: flags=8943
mtu 1500
inet 192.168.0.1 netmask 0xffffff00 broadcast 192.168.0.255
inet6 fe80::2bd:65ff:fee2:6601%vmnet1 prefixlen 64 scopeid 0x9
ether 00:bd:65:e2:66:01
I also saw the following existed:
janney# ls /compat/linux/dev
hda null tty0 tty10 tty12 tty3 tty5 tty7 tty9 vmnet1
hdb rtc tty1 tty11 tty2 tty4 tty6 tty8 vmmon
I made sure my /usr/local/lib/vmware/licenses/user/license.ws.3.0 file had the appropriate license, and then fired up VMWare. I installed Red Hat Linux 6.2 as a test OS. For networking I created a "custom" entry with /dev/vmnet1. Once the OS installation was complete everything worked. I could ping my gateway and reach the VM from outside hosts.
Tuesday, January 06, 2004
Finisar Tap Advice Strains the Brain
This document mentions the IL/1 and advocates plugging the tap outputs into a hub. The problem with this is simple: a tap preserves the full-duplex nature of a link between switches. Full-duplex means both ends can transmit simultaneously. What happens to packets transmitted simultaneously when they enter a hub? BANG -- collision. That's no problem on a half-duplex medium like unswitched Ethernet, since the transmitters will sense the collision (hence Carrier Sense Multiple Access Collision Detection). The parties will back off and retransmit, hoping for better luck next time.
With a full-duplex tap, there is no retransmission. The two simultanous packets collide and the original transmitters never hear the packets' silent death scream. I see many posts to IDS newsgroups advocating this horrible design strategy, with posters cheerfully claiming their IDS handles Fast Ethernet speeds with no packet loss. The problem is their IDS never sees the majority of the traffic, as it dies in a collision-ridden blaze of misfortune.
Below is a capture of the document in question:
Intrusion SecureNet IDS Tap 10/100. It sports a single transmit output, meaning it combines two transmission streams, potentially operating at over 50 Mbps, into a single output. When the total of the two TX inputs exceeds 100 Mbps, we have another traffic issue -- dropped packets.
Someone please email me at blogspot at taosecurity dot com to tell me I'm misinterpreting this Finisar document. I don't see how this is a good idea. The document even shows two cables going straight into a hub. Unbelievable.
Options for Security Shell History in FreeBSD
Unfortunately I couldn't find exactly that, but I did locate this excellent article at DefCon1.org. The author explains how to use FreeBSD's chflags utility to prevent users from deleting the Bash .history file. The author also explains how to set up process accounting via acct and mentions briefly how to use the sa and lastcomm utilities. His recommendations worked on one of my FreeBSD 4.9 REL boxes as described.
Monday, January 05, 2004
Review of Understanding Open Source Software Development Posted
"UOSSD is the perfect introduction to OSS for those outside the community. The book takes a fairly balanced look at the people and processes which define the open source movement. Although some aspects of the book have grown stale over the last three years, I still recommend UOSSD to those desiring a deeper look at the open source phenomenon."
This is my first new review of 2004. Last year I read and reviewed 33 technical books.
Sunday, January 04, 2004
Binary Patching with OpenBSD
Essentially I downloaded all eight archives and applied each as follows. So, to apply the first set of patches:
wget http://www.openbsd.org.mx/pub/binpatch/3.3/i386/binpatch-3.3-i386-001.tgz
tar -xzvpf binpatch-3.3-i386-001.tgz -C /
Then I downloaded the second set and untarred them, and so on. When I was done I rebooted and found my system had a new kernel:
OpenBSD 3.3 (GENERIC) #3: Sat Oct 4 12:38:19 CDT 2003
Note my kernel was GENERIC to begin with.
Friday, January 02, 2004
Chaosreader Rocks
# These ports have been selected to be saved as coloured 2-way HTML files
@Save_As_HTML_TCP_Ports = (21,23,25,79,80,109,110,119,143,513,514,1080,
@Save_As_HTML_UDP_Ports = (53);
# These ports have been selected to be saved as realtime playback scripts
# (telnet, login, and numerous IRC ports)
@Save_As_TCP_Playback_Ports = (23,513,4110,5000,5555,6660,6666,6667,
@Save_As_UDP_Playback_Ports = (7);
Chaosreader presents the information in .html files for easy browsing. When it rebuilds a session, say for telnet, it creates a Perl script that you can run to watch the keystrokes replay in real time. I'm looking forward to seeing the author implement X11 replay. The Review package is supposed to have this capability but I've never tried it.
Ipsumdump Summarizes Network Traffic
bourque# ipsumdump -tsSdD -i sf1
warning: sf1: no IPv4 address assigned
!IPSummaryDump 1.1
!creator "ipsumdump -tsSdD -i sf1"
!host bourque.taosecurity.com
!runtime 1073092478.545313 (Fri Jan 2 20:14:38 2004)
!data timestamp ip_src sport ip_dst dport
1073092486.925087 172.27.20.11 - 192.168.60.3 -
1073092486.925253 192.168.60.3 - 172.27.20.11 -
1073092529.535523 192.168.50.2 23924 192.168.60.3 22
1073092529.535689 192.168.60.3 22 192.168.50.2 23924
1073092529.543094 192.168.50.2 23924 192.168.60.3 22
1073092529.545758 192.168.60.3 22 192.168.50.2 23924


text:
Daily Trojan, Vol. 28, No. 39, November 13, 1936
|Save page Remove page
|1 of 4
small (250x250 max)
medium (500x500 max)
large (1000x1000 max)
Extra Large
full size
Full Resolution
All (PDF)
This page
Loading content ...
rial Offices 4111, Sta. 227 ___ PR-4776 SOUTHERN DAILY CALIFORNIA TROJAN United Press World Wide News Service Los Angeles, California, Friday, November 13, 1936 Number 39 Ific Starts loving Across S.F. Bay Bridge Charges Bring State Hour During Opening Period ■ess Procession Moves L « AH Night X Co Across Largest I Span m_World K FRANCISCO. Nov. 12.— TOe San Francisco-land bay bridge, the I's longest, highest, wid-and costliest overwater began paying for itself tie spectacular rate of j an hour immediately it was opened with elab-ceremonles today. ttn thousand automobiles I across the eight and one half itnicturc In the first two and Ul hours of its operation. Each raid a 65 cent toll for hlm-uT»utomobile and three pasts; extra riders dropped a each into the toll boxes at Hkland end of the bridge. Endless Procession it seems no end to the pro-D "f automobiles which moved I the bridge plazas to the six ipper deck. San Francisco bay height of several hundred feet water through the Yerba L island tunnel, largest bore \ world, and down to street 'again on the San Francisco f Oakland side. ie automobilists had waited all [for the opportunity to be the tcross when the chains were fin official ceremonies shortly £n and a signal from Presi-[Roosevelt in Washington W a giant "go" signal to re-[the flood of traffic. Crossin* Time Shortened he experts believe the nor-tme required for crossing will found 13 minutes, as against it now takes on the auto-Itrries. bridge probably will receive t real test, after the opening Hcitement, on November 19 It will be called upon to Huskie Backs Seattle-Bound Trojans Near Northern Goal U.S.C. Grid Contingent To Arrive in Huskie Land This Morning Headman Withholds Plans Sophs, Skippered by Davis, Rumored as Starters In Crucial Game The tu o capable looking football players pictured above are Al Cruter {top), aad Ed Souogroskt, the tuo hard-hitting fullbacks oj Coach Jimmy Phelan's W'a<hington eleven. Although f^ouogroski generally gets thc starting call, Cruter probably will open against the Trojanr tomorrow, uith Nowogroski on the sidelines nursing an injured leg. President To Talk At Religion Forum "John R. Mott. Builder of World Friendship," will be the subject of an address to be given by Dr. Rufus . , .. . , "" """ , B. von KleinSmid before the seven- much of the crowd of 90,000 .. , , . . ,, . [or the California-Stanford , th wepkl>r religious forum Monday at 4:15 p. m. in Bowne room, Mudd Memorial hall. Born ln 1865, Dr. Mott obtained degrees from Cornell, Yale, Edinburgh, Princeton, and Brown. The 71-year-old religious worker has served as chairman of many YMCA and Christianity commissions. During the world war, he was general secretary of the national war work council of the YMCA. Decorations were conferred upon him by France, who made him a Knight of the Legion of Honor, Japan, who awarded him the Order of the Sacred Treasure, and the United States, lor the Califomia-Stanford 11 game in Berkeley. lief Efforts oBe Explained I' marks the deadline on itlons for the high tea at members of U. S. C.'s and I. A.s Religious Conference will hear Victor Rossetti. »t of the Citizen's National and of the Community Chest, the function of the' Chest." -ucian Davis, chairman of the it board this morning. Mtal Ior the affair may d* in the Religious Confer- \ who honored him with the Distin-tfice, 230 Student Union, and 1 guished Service medal, w made for admission to the | Author of 13 books. Dr. Mott has 0Ir"ar>' v McCormick, 15062 also written many articles and Del Mar, where the affair pamphlets. His latest book. "Co-- * P m' ®untlay, operation and the World Mission,' By Clark Jones ABOARD TROJAN SPECIAL Dunsmuir, Calif.. Nov. 12 — (Exclusive) — Troy's Thundering Herd, its company of coaches, doctors, sports writers, and more than 75 rooters are at present passing Mt. Shasta. In a few hours we will be into Oregon territory. Tomorrow at 10:30 the Trojan contingent will be in Seattle, the scene of Saturday's conference football contest. Headman Howard Jones has been a proverbial question mark to the galaxy of reporters on board. He has refused to state whether he will continue his two-team system or resort to picking the strongest combination from the two outfits. There Is a rumor afloat, however, that the sophomore team will start with Davie Davis skippering the youngsters from the quarterback post. Norton Is Ready The announcement last night by Dr. Philip S. Feisler that Miles Norton, varsity tackle, would be ln shape to play, was greeted with satisfaction by Jones. "If we are to halt the running attack of the Huskies, we will need full strength at our tackle spots," the Headman remarked. Norton will be kept ln reserve Saturday along with Max Belko. Don McNeil and Ray Oeorge, sophomores, are slated to get the opening call. Ray Halvorson, husky sophomore guard who was taken north at the last minut-e, will not be ln shape to play. Dr. Feisler stated. He will be the only man out of the lineup because of injuries. Band Serenades Team Yesterday morning the team was greeted at Sacramento by the Grant high school band. A large crowd was on hand to watch the team disembark. Al Phaen and Ernie Smith, former Trojan athletes, led the array of Sacramento rooters. More than 300 spectators followed the herd to the Junior college stadium, where a brisk workout was held. The Trojans were drilled especially ln defense against laterals. Since last Saturday's upset at the hands of California, Jones has started to concentrate on trick stuff which he fears the Huskies (Continued on pair« three) Formuhi for Peace + * * * Keep Soldiers in U.S.' j KANSAS CITY, Mo., Nov. 12— tU.fi)—Maj. Gen. Smedley D. Butler, whose marines used to act as roving policemen for America, today advanced a new formula for keeping this nation out of useless wars. "Not one soldier out of the Continental United States,'' Butler said. Not even for defense of the Panama canal would have American soldiers sent out of the country. ' "Why, one man alone could carry-enough dynamite to close the Panama canal so effectively lt would take three months to dig lt out," he explained. Butler aided In building the canal. "Keep all of our soldiers at home and our warships within 1,000 miles of our shores and the United States is safe," Butler said. "We cannot be Invaded." Butler also favored abandoning the Hawaiian Islands. House Decoration Deadline Selected Homecoming Competition l o End November 30; Plans Requested Instructions to fraternities and sororities relative to house decorations for Homecoming week were issued by Jaye Brower and Dorothy Dudley last night. Both committee chairmen declared that all sketches for house decorations featuring the theme "Thundering Back With the Thundering Herd' must be in by next Monday, or the house will automatically be disqualified from competition. That special attention should be paid to the change on the deadline date was stressed by Brower and Miss Dudley. The committee on awards consisting of Frank F Barham, C. Raymond Johnson. Sheriff Eugene Biscailuz, and Major Carl Wlrschlng will judge the various houses Monday afternoon, November 30, and will present six awards. Therefore, all decorations must be up by Monday noon, stated the fraternity and sorority contacts chairmen. Because the weekend following the Thanksgiving game Is a holiday. Brower and Miss Dudley urge all fraternities and sororities to have their pledges on hand at that time to complete the decoration of houses. Fraternity presidents are asked to submit their ideas either to Brower or to Lee Roy Kirkpatrick, his assistant, In 217 Student Union, and sorority presidents are asked to send their sketches to Dorothy Dudley in the WSGA office. Final Plans for Squires' Dance To Be Decided Professor To Talk On Use of Abacus to Davis. 1 was published last year. U.S.C. Organizations Kappa Zeta Dr. S. Takahashi, professor of "rapid calculation" from the Government Technical college, Nagoya, Japan, will demonstrate the use of the "abacus" In 243 Old College at 10:25 this morning and again in 240 Old College at 11:25. His address will be Interpreted by Naml-jl Itabashi. president of the Oriental Cultural society which has recently been organized to help students in studying Oriental cultures, "Professor Takahashi Is the outstanding abacus expert in Japan," says Dr, F. W. Woodbridge, professor of accounting. 'He carries W Zeta, honorary pre-medl-mity. announces presanta-w Pledges ui the Student •Wal lounne at 12:30 ;oday. -i,*011 honoring the neophytes their introduction. H?,naT Nat,mn Carl. Os-bno'a Ck Wllson- and Har* To discuss final plans for their informal dinner dance to be held tomorrow night in the Colonial room of the Ambassador hotel. Trojan Squires will meet today in 305 Administration, it was revealed yesterday. Ron Briggs, vice-president of the Squires and social chairman of the j through extended calculations more formal, asked yesterday that com- | rapidly with the abacus than it Ls mittee members submit completed I possible to do with modern calcula-reports regarding details of seating tion equipment. He will also show Five men will be Initiated into ] arrangements, place-cards, and cor- | us a motion picture illustrating the Alpha Phi Omega, national profes- | sages. speed with which the abacus is slonal service fraternity, next Sun- { AU funds for the forma) must be | used." day at 2 p m. in the banquet room I paid today, Stan Rousso. treasurer, ] Any student interested in these of the Casa de Rosas inn. Dr. | announced last night. | lectures may attend, says Dr. Wood- Jones Lecture On Christianity, Heard by 1800 Noted Authority Discusses Problems of Religion In Scientific Age 'World in Need of Uplift' 'No Need for Communism, Fascism in America,' Declares Author E. Stanley Jones proved no disappointment to 1800 Trojan students who gathered to hear him in Bovard auditorium yesterday morning. "What Can We Believe in An Age of Science?" he asked them. Then, pleasingly, but concretely, he told the 1800 not only what they might believe in these confusing times, but also what comfort they might derive from their belief. "You often hear it said today that any change or advancement ln our living must come under one of two systems—communism or fascism," Dr. Jones stated. ''Let me tell you that we need have neither communism or fascism In America. Religion has something more to offer than either of these. Religion offers the opportunity to have life and to have lt more abundantly." Religion Brings Relief That religion can provide the goodwill necessary to bring general spiritual uplift to a nation and a world sorely in need of uplift, was Dr. Jones' earnest contention. "We must grow tired of an economic system that allows us to live half-starved and half-stuffed,'' was the way he put It, showing again how religion1 offers the way out. Regarding alleged conflict between science and religion, the speaker described science as a quantitative factor, and religion as a qualitative factor. Religion, he believes, makes a universe of the multlverse left us by science. Science v*. Christianity "Yet science," he continued, "has run ahead of religion, where it should have offered religion a new goal. We have only to look back on the great war to see a horrible situation wherein man's soul and intelligence failed to keep the pace set by science. Civilization must strive toward the day when Christianity will supplement scientific technique.'* "But the scientific approach alone will never lead to God,'1 Dr. Jones concluded. "I don't know what electricity ls," he laughed, "but I'm not going to sit in the dark until I find out. I don't know all that there Is to know about my digestion, but I'm not going to starve until I can learn. "Lastly, I don't know all about Ood; I can't prove Him. But by trying to take Christ's way toward Him, I feel confident He may be found " Radio, Screen Stars Will Appear at Knight's All-U Dance at Riviera Tonight Alpha Phi Omega Greek Workers In Chest Drive Are Appointed Co-Chairmen Pick Workers To Secure Gifts From Fraternity Men The University of Southern California community chest drive was begun yesterday when Fred Hall, Phi Kappa Tau, and Lawrence Nelson, Kappa Alpha, co-chairmen in charge of fraternity contributions, announced the men who will take care of the collections in their respective houses. HaU reported that last Tuesday the Interfraternity council voted 100 percent support of the drive and that last night five fraternities had already pledged 100 per cent support, promising that donations would be made by all of their actives and pledges. Civic Obligation "Commenting on the campaign." Hall said. "Every fraternity man should regard his contribution to the community chest as a true civic obligation. We cannot afford to be Indifferent to the plight of those less fortunate than ourselves I sincerely hope that the cooperation this year will result In the greatest drive ln the university's history." The men chosen by Hall and Nelson to represent their houses are Dave Schwartz, Alpha Ep tlon Pt; John Miller, Sigma Phi Epsilon: Bill Broomfield. Phi Kappa Psi; Ralph Sharon, Chi Phi; Bob Tropp, Tau Epsilon Phi; Bob McClain, Alpha Rho Chi; Rod Hansen. Delta Sigma Pi; Jim Kerr, Pi Kappa Alpha. Workers Named Bob Hunter, Delta Chl; Ed James, Kappa Sigma; Sterling Smith, Sigma Nu; Bill Harris. Phi Sigma Kappa; Tom Guernsey, Sigma Alpha Epsilon; Henry Wheeler. Beta Kappa; Leon Rosen, Zeta Beta Tau; John Elsenbelss, Delta Sigma Phi; Charles Schweitzer, Sigma Pht Delta; and Fred Keenan, Sigma Chl. A meeting of these men has been called by the co-chnlrmcn to be held in the men's lounge of the Student Union at assembly period today. Band Leader Don Ricardo, producer oj suave melodies hom musical instruments, will lead hit orchestra at the Knights sword and shield dance at the Riviera country club tonight. Culture of Orient Will Be Studied O'Neill Wins Nobel Literature Award The Oriental Cultural society, a new organization, calculated to serve the Interests of students of Oriental cultures, Is now In the process of formation at U. S. C. "In consideration of the present situations of the Far East," says Namljl Itabashi, one of thc organizers and a political science major. "Our proposed organization will help students ln understanding the cultural background of the Orient, with particular emphasis on China and Japan, by means of motion pictures, talks by recognized authorities on China and Japan, and by making available to members a collection of periodicals and books dealing with the commonplace and unusual cultural aspects of the two countries. "At the same time, tt will serve as an intermediate station, directly connected with similar organization throughout the world, for Information, and the promotion of more friendly relations between the East and West." . Political phenomena, according to the organizer, will be rigidly excluded from the discussions and study programs of the society. At present 15 members have affiliated with the group. Dr. Hans N. von Koerber has been Invited to serve as faculty sponsor. Trojan Sword To Be Flashed By Honor Men Committee Bans Corsages; Festivities To Start At 9 O'Clock Featuring stars of the entertainment world, Trojan Knights will tonight act as hosts to the ASUSC at their first annual sword and shield dance. The affair, planned for the Riviera country club, will start at 9 o'clock. Betty arable, prominent vocalist and actress ls being headlined a.s one of the colorful attractions. Miss arable recently finished work on "Pigskin Parade," a Twentieth Century-Fox production As a singer, she formerly appeared with Ted FloRlto'g orchestra. Tolson To Sing Heading the list of masculine singers will be Jimmy Tolson. formerly with Phil Harris' orchestra and more recently connected with pictures. He has worked for both RKO and MOM studios. For dancing entertainment, the Knights have engaged an internationally famous dancing duet. Thl.' team recently finished a successful run at the Onyx club in New York. Following this engagement they made a tour of Europe, dancing before thU critical audiences of the European nations. Harris Will /Ippear At. a late hour last night. Johnny Parker, entertainment chairman, stated that Harry Barris, in the past a member of Paul Whitman* rhythm boys, and popular soloist, would entertain. It was also confirmed that Loyce Whitman would be present and would sing on thc program. Miss Whitman Is now engaged ln motion picture work In Hollywood. Don Ricardo, popular musical maestro and his 13-plece orchestra, has been procured to play for tonight's dancing. Ricardo ls known nationally a* a purveyor of sweet music. Knight officials emphasized yesterday that corsages would be banned. STOCKHOLM. Nov The Nobel award for literature was given today to Eugene O'Neill, American playwright, who has been recognized for years as one of thc world's outstanding modern dramatists. 12-d hi -i Whiting's Band »rnt.urp wok " Will Appear at Lancers' Dance w estminster J* a penny luncheon for ! in >, ?'embm Westminster ! U weeklV luncheon ; •SS&S:Cottaee ,ea •ti.y, t-fusinger. assistant ' Tknatf Immanuel tun n cll"reli will address Spini Ur Bellef m the Francis Bacon, counselor of men, and James Lynch, president, will be In charge of the candlelight ritual The men to be initiated are: A Pierce Amos, William E. Brent, Charles Brust, John Mangun, and Raymond Rees. The Initiation ceremony will follow a dinner. "Every Squire who intends to I bridge come to the dance must pay in j full today." Rousso said. Deseret To discuss plans for a dance for Deseret clubs from southland universities. the U. S. C. Deseret club wUi meet today at 10 a. m In the Student Union lounge. Award of Pyre Trophy Delayed Trailers Banned ORCHARD LAKE. Mich., Nov. 12 - (I'.K) — Automobile trailers, in which thousands of "modern nomads" have taken to the highways, were banned from Orchard Lake tonight by a decision ln Justice court Art Whiting and his 15-plece orchestra will furnish the music for the Lancer dance that will be held tonight from 8:30 to midnight, at Occidental college. The dance will be strictly a semi-formal affair. "No admission will be charged, so we expect at least 200 Lancers to attend," said Phyllis Hight, social chairman of the Lancers. "All that, is required Is that one be a Lancer " Unafflllated students from U. C. L. A., Occidental, Cal Tech, Loyola. | and Chapman college wil attend. | A special session of the Lancer Awards vary in amount from year administrative board is scheduled to year, depending on the income for 9:55 a. m today in the senate from the Nobel trust fund This j chamber, stated Foy Draper, presl-year they are worth 159.850 kroner, j dent of the non-org group, last or approximately $40,000. night. The award for physics was conferred by the prize committee Jointly on Doctor Carl David Anderson, Swedish-Amencan wostor, and on V F. Hess, an Austrian professor It was decided that the 1935 prize for literature would not be given. The 1936 prize for chemistry was awarded to Peter Jos Wilhelm Debye, a Hollander, now a professor ln the Kaiser Wilhelm institut fuer | physlk ln Berlin. A Cappella To Sing On Beach Program i Cappella choir, under thc direction of Mr. John Smallman, will make Its first public appearance of the year today when it participates ln the Bach festival at the First Congregational church. Tlie program, which starts at 4 p. m., will be the first in a series of four presentations to be given by the church ln which the choir will sing. "Jcsu Prlc;!ess Treasure" ls the song to be offered by the group today. The 75 A Cappella members will take an active part in the Vesper program to be given at Bovard auditorium on November 22. At present no definite musical selections have been decided upon for the choir. Minicam^Club | Newman Dance **1 meeting of the Troian ! - , . c'ub has been called to The Newman club will hold its ,I~° Appleman. president in annu»l fall dance tomorrow cven-""t members may insDect a 'ng at llle Aliena golf and coun-8er and vote on the nur- I tr>' c!ub at 9 o'clock. Members from » I!!...1*11* equipment The ® ^ ^ ■ Pasadena £ take place at 12 20 Junior college, and Los Angeles ju-3 8einir... v...,, . ntor college will be present. Postponement of the announce-ment of the winner of the CUP ^ O ; C..,,,,,, which was to be given to the fra- tjCJUIVLS Jt C U) t ternity doing the best work on the bonfire was made yesterday after Frank Thornquist and his committee had deliberated for a week. "So close were several of the leading fraternities that It was impossible for the judge-. Bob Trapp. Caroline Everington, and Norm Johnson, to pick the winner," Thornquist said. Stop Sign For Auto ists Sale of Ducats For Bruin Fray To Open Today Today, lor the first time, tickets for the U. C. L. A. game go on public sale at downtown agencies. By the first of next week more than 75.000 tickets which already have been ordered will be in the mails, according to a report released by the ticket department yesterday. Graduate Manager Arnold Eddy said that the tickets now on sale at the Broadway store in Hollywood. Phelps Terkel, Bullocks, and the campus bookstore are all $2 75 j seats ln the east end of the coll-j seum. These are the only seats I still available. I Students may secure their rooter's tickets at the book tore ticket | office for $1.10 any time next week or during the three school days preceeding the game The largest U. S. C. rooting section of the year accommodating 3000 students, hau ---- ------.---, -------------------- . been reserved for the Thanksgiving humor magazine, when captured by Daily Trojan reporter* i After having participated In four practice debates with the squads of Glendale Junior college and L. A J. C" the U. S. C. frosh debaters, under the management of Albert Weissberg, are negotiating engagements with the Santa Monica and Pasadena junior college* Weii-sberg says the squad is look-ing for opponents and welcomes any bid for his group's activity. Homer H. Bell Is coach of the "No, I positively refuse to say a word about this new issue i freshman squad which includes: of the Wampus," avowed Worth Larkin, demure editor of the Glen Stephens, Edward Ptersoi. Worth Larkin Won't Talk; Wampus Cat Gets Tongue Frosh Debaters Finish Practice cmuuoMh havi*' located "» °f the phy-jpg wing Sl8ma Delta Pi ^Dr *1 hT> subjecl- ' Modern 10 'Mtrm.iw, ^0l-vz01des- >ec-aiinT'110"81 relations and J ot Orl, rettor 01 tlie fcembers ^lture' will ad-U honor, r P>- * 1:J0 n i, Spanish frater-Sunday ia the Taxi Day Committeemen Named; Dudley Is Leader I Announcement of Dorothy Dudley Cosmopolitan ■ as chairman of Taxi day was made --I by Lucille Hoff, president of WSGA A special meeting for Cosmopol- j last night, man cluo members will be held dur- The day ln which coeds a sume ing chapel jjeriod this morning In i drivers' positions and steer queer the Student Union lounge, an- autos up and down University ave- nounces President Jose Caceres. The purpose of the meeting is to disseminate tickets lor the Cosmopolitan club luncheon scheduled tor 12:15 p. m. today in Lliaabetl) von KleinSmid hall. nue will take place December 3. Serving as committee members wUl be: lone Hooven, Kay Young, Betty Jane Bartholomew. Marcia James, Pat ReiUy, and CecUe Hallingby. With the successful culmination ol a three-year campaign lor the Installation of a boulevard stop at 30th street and University avenus. the Trojan Squires, under the chairmanship of John Mangun, are concentrating on having a slop dgn erected at 28th street and University avenue. "We wish to extend our thanks to the fraternities and sororities for the letters which they wrote to the Los Angeles traffic division to aid our campaign. Each one of them helped immeasurably to make our mission a success." said Mangun. Mangun was assisted by Don McAllister In the campaign day fray. Auto Park Staff Named To Work for Bruin Game The list of parking lot workers for thc U.C.L.A -Washington State game tomorrow afternoon was re-leared from Leo Adams' office yesterday. The following men are to report at 10 a m. tomorrow behind Mudd hall: W. Garrison and A. Ronand-I er- The following men are to report at noon behind Mudd hall; B. Dale, C. Anderson. J. Reynolds, H. Rem-sen, D. Cornett, K. Seiling, R. Staley, G. Ooodrich, D. Olsen, N Martin, J. Hansen, and B. Norton. for publication purposes yesterday in his luxurious offices on the second floor of the Student Union. "No. no no. noi one word will* Undecided whether he will make I utter." he continued in a falset- i this Issue, whose theme is roughly to, "other than this succinct state- : "University Society and the Soror-ment: This Issue, which will b: out I ities," pornographic, lecherous, or Wedne day, is positively the best : bawdy, Larkin declared that he is I Wampus 1. with the aid of ray j "frankly oppo ed to the black arts doddering staff, could put out." <>( all sororities, and ls determined ' that exposure ls the only remedy." "My pictures, and my art—all lard Huick, Mort Brigadier, William Barton, and Arthur Guy. Contending that no other Wampus editor had ever made this claim, Larkin asserted that it was his belief that the slogan "tlie bes Wampus ever' would probably enjoy as much currency as "Look at Spain and Vote Like Maine " The reason for his silence is the "unreasonable edict of my staff which limits the use of my name in Wampus publicity stories to four times a sentence," the editor stated. the things I selected—are daringly exotic. I think. In fact, as I do not wish to be quoted at all, just bear this in mind: I'm putting out a magnificent Wampus next week despite the staff's efforts at sabotage in the matter of publicity. That's all, except you will notice my strenuous efforts to avoid the use of the personal pronoun," he concluded proudly. Botany Classes To Start On Field Trip Tomorrow Botany students of the university will start tomorrow morning at 9:30 for a weekend field trip through the San Jacinto mountains and the Palm Springs area, arriving back In Los Angeles by 6 p. m. Sunday. The party of 50 students, accompanied by two members of the botany staff, will study the plant life of mountain and desert to trace the relations and gradations from the chaparrel mountain meadows and conifers of the coastal regions to the cacti and desert plants ot the desert (Ida
Object Description
|Daily Trojan, Vol. 28, No. 39, November 13, 1936
|Format (imt)
|Full text
rial Offices
4111, Sta. 227 ___ PR-4776
United Press World Wide News Service
Los Angeles, California, Friday, November 13, 1936
Number 39
Ific Starts loving Across S.F. Bay Bridge
Charges Bring State Hour During Opening Period
■ess Procession Moves
L « AH Night
X Co Across Largest I Span m_World
K FRANCISCO. Nov. 12.— TOe San Francisco-land bay bridge, the I's longest, highest, wid-and costliest overwater began paying for itself tie spectacular rate of j an hour immediately it was opened with elab-ceremonles today. ttn thousand automobiles I across the eight and one half itnicturc In the first two and Ul hours of its operation. Each raid a 65 cent toll for hlm-uT»utomobile and three pasts; extra riders dropped a each into the toll boxes at Hkland end of the bridge.
Endless Procession it seems no end to the pro-D "f automobiles which moved I the bridge plazas to the six ipper deck. San Francisco bay height of several hundred feet water through the Yerba L island tunnel, largest bore \ world, and down to street 'again on the San Francisco f Oakland side.
ie automobilists had waited all [for the opportunity to be the tcross when the chains were fin official ceremonies shortly £n and a signal from Presi-[Roosevelt in Washington W a giant "go" signal to re-[the flood of traffic.
Crossin* Time Shortened he experts believe the nor-tme required for crossing will found 13 minutes, as against it now takes on the auto-Itrries.
bridge probably will receive t real test, after the opening Hcitement, on November 19 It will be called upon to
Huskie Backs
Seattle-Bound Trojans Near Northern Goal
U.S.C. Grid Contingent To Arrive in Huskie Land This Morning
Headman Withholds Plans
Sophs, Skippered by Davis, Rumored as Starters In Crucial Game
The tu o capable looking football players pictured above are Al Cruter {top), aad Ed Souogroskt, the tuo hard-hitting fullbacks oj Coach Jimmy Phelan's W'a
|Archival file


text:
Door or wall too deep for your pet door? Use an extension for your pet's ease! This tunnel is compatible with the Original 2 Way Pet Door (700 Series) and measures 50mm (2") deep.
Small children can pass through door. Read entire statement.
How come they offer different size doors in 700 series yet when it comes to the extension tunnels, they only come in small. Not helpful at all for people with larger dogs.
> PetSafe Response: Hi Kirstie, we do have the 700 Series Extension Tunnels available in other sizes. At this moment, they are only available through our Customer Care team and I have asked someone to get in touch with you today. The additional sizes available are Medium (MPA00-12633) and Large (MPA00-12634). Thanks for your feedback!


text:
|Paul Leroux
Come to think of it, helping people learn has become something of a specialty for Chris. He is, for example, a flying instructor and the author of Flying Beyond: The Canadian Commercial Pilot Textbook. And, as a software safety specialist at QNX Software Systems, he regularly provides advice to customers building systems that must comply with functional safety standards like IEC 61508, EN 5012x, and ISO 26262.
Chris has already written a number of papers on software safety, some of which I have had the great privilege to edit. You can find several of them on the QNX website. But recently, Chris upped the ante and wrote an entire book on the subject, titled Embedded Software Development for Safety-Critical Systems. The book:
- covers the development of safety-critical systems under ISO 26262, IEC 61508, EN 50128, and IEC 62304
- helps readers understand and apply remarkably esoteric development practices and be prepared to justify their work to external auditors
- discusses the advantages and disadvantages of architectural and design practices recommended in the standards, including replication and diversification, anomaly detection, and so-called "safety bag" systems
- examines the use of open-source components in safety-critical systems
I haven't yet had a chance to review the book, but at 358 pages, it promises to be a substantial read.
Interested? Well, you can't get the book just yet. But you can pre-order it today and get one of the first copies off the press. It's scheduled for release September 1.